forked from pool/libquicktime
b5487635f3
- add libquicktime-1.2.4-integer_overflow.patch to fix integer overflow in the quicktime_read_pascal function in libquicktime 1.2.4 and earlier that allows remote attackers to cause a denial of service or possibly have other unspecified impact via a crafted hdlr MP4 atom [bsc#1022805] CVE-2016-2399 OBS-URL: https://build.opensuse.org/request/show/457096 OBS-URL: https://build.opensuse.org/package/show/multimedia:libs/libquicktime?expand=0&rev=64
14 lines
467 B
Diff
14 lines
467 B
Diff
Index: libquicktime-1.2.4/src/util.c
|
|
===================================================================
|
|
--- libquicktime-1.2.4.orig/src/util.c
|
|
+++ libquicktime-1.2.4/src/util.c
|
|
@@ -340,7 +340,7 @@ int64_t quicktime_byte_position(quicktim
|
|
|
|
void quicktime_read_pascal(quicktime_t *file, char *data)
|
|
{
|
|
- char len = quicktime_read_char(file);
|
|
+ unsigned char len = quicktime_read_char(file);
|
|
quicktime_read_data(file, (uint8_t*)data, len);
|
|
data[(int)len] = 0;
|
|
}
|